mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 11:53:37 +00:00
chore: Remove en-us from msdn.microsoft.com links
This commit is contained in:
Nick Schonning
@ -19,7 +19,7 @@ ms.date: 06/26/2017
|
||||
|
||||
### EnterpriseAppVManagement CSP node structure
|
||||
|
||||
[EnterpriseAppVManagement CSP reference](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp)
|
||||
[EnterpriseAppVManagement CSP reference](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp)
|
||||
|
||||
|
||||
|
||||
@ -83,9 +83,9 @@ ms.date: 06/26/2017
|
||||
|
||||
<p>A complete list of App-V policies can be found here:</p>
|
||||
|
||||
[ADMX-backed policy reference](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/policy-admx-backed)
|
||||
[ADMX-backed policy reference](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-admx-backed)
|
||||
|
||||
[EnterpriseAppVManagement CSP reference](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp)
|
||||
[EnterpriseAppVManagement CSP reference](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp)
|
||||
|
||||
### SyncML examples
|
||||
|
||||
@ -133,7 +133,7 @@ ms.date: 06/26/2017
|
||||
|
||||
<p>Complete list of App-V policies can be found here:</p>
|
||||
|
||||
[Policy CSP](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider)
|
||||
[Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider)
|
||||
|
||||
#### SyncML with package published for a device (global to all users for that device)
|
||||
|
||||
|
||||
@ -168,7 +168,7 @@ Supported operations are Get, Add, Replace
|
||||
If Add is called on this node and a blob already exists, it will fail. If Replace is called on this node, the certificates will be overwritten.
|
||||
If Add is called on this node for a new PFX, the certificate will be added. If Replace is called on this node when it does not exist, this will fail.
|
||||
In other words, using Replace or Add will result in the effect of either overwriting the old certificate or adding a new certificate
|
||||
CRYPT_DATA_BLOB on MSDN can be found at http://msdn.microsoft.com/en-us/library/windows/desktop/aa381414(v=vs.85).aspx
|
||||
CRYPT_DATA_BLOB on MSDN can be found at http://msdn.microsoft.com/library/windows/desktop/aa381414(v=vs.85).aspx
|
||||
</Description>
|
||||
<DFFormat>
|
||||
<bin />
|
||||
|
||||
@ -15,7 +15,7 @@ ms.date: 08/27/2018
|
||||
|
||||
A configuration service provider (CSP) is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. Some configuration service providers support the WAP format, some support SyncML, and some support both. SyncML is only used over–the–air for Open Mobile Alliance Device Management (OMA DM), whereas WAP can be used over–the–air for OMA Client Provisioning, or it can be included in the phone image as a .provxml file that is installed during boot.
|
||||
|
||||
For information about the bridge WMI provider classes that map to these CSPs, see [MDM Bridge WMI Provider](https://msdn.microsoft.com/en-us/library/windows/desktop/dn905224). For CSP DDF files, see [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
|
||||
For information about the bridge WMI provider classes that map to these CSPs, see [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224). For CSP DDF files, see [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
|
||||
|
||||
|
||||
Additional lists:
|
||||
|
||||
@ -33,7 +33,7 @@ To write a custom configuration service provider, the OEM must implement the fol
|
||||
|
||||
- [ICSPValidate](icspvalidate.md) (optional, for UI only)
|
||||
|
||||
This code must be compiled into a single .dll file and added to a package by using the instructions found in "Adding content to a package" in [Creating packages](https://msdn.microsoft.com/en-us/library/windows/hardware/dn756642). While writing this code, OEMs can store registry settings and files in the following locations.
|
||||
This code must be compiled into a single .dll file and added to a package by using the instructions found in "Adding content to a package" in [Creating packages](https://msdn.microsoft.com/library/windows/hardware/dn756642). While writing this code, OEMs can store registry settings and files in the following locations.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
|
||||
@ -12,7 +12,7 @@ ms.date: 06/26/2018
|
||||
|
||||
# DeveloperSetup CSP
|
||||
|
||||
The DeveloperSetup configuration service provider (CSP) is used to configure Developer Mode on the device and connect to the Windows Device Portal. For more information about the Windows Device Portal, see [Windows Device Portal overview](https://msdn.microsoft.com/en-us/windows/uwp/debug-test-perf/device-portal). This CSP was added in Windows 10, version 1703.
|
||||
The DeveloperSetup configuration service provider (CSP) is used to configure Developer Mode on the device and connect to the Windows Device Portal. For more information about the Windows Device Portal, see [Windows Device Portal overview](https://msdn.microsoft.com/windows/uwp/debug-test-perf/device-portal). This CSP was added in Windows 10, version 1703.
|
||||
|
||||
> [!NOTE]
|
||||
The DeveloperSetup configuration service provider (CSP) is only supported in Windows 10 Holographic Enterprise edition and with runtime provisioning via provisioning packages. It is not supported in MDM.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 06/26/2017
|
||||
# DMProcessConfigXMLFiltered function
|
||||
|
||||
> **Important**
|
||||
The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. Please see [Connectivity configuration](https://msdn.microsoft.com/en-us/library/windows/hardware/dn757424) for more information about the new process for provisioning connectivity configuration. However, this function is still supported for other OEM uses.
|
||||
The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. Please see [Connectivity configuration](https://msdn.microsoft.com/library/windows/hardware/dn757424) for more information about the new process for provisioning connectivity configuration. However, this function is still supported for other OEM uses.
|
||||
|
||||
|
||||
Configures phone settings by using OMA Client Provisioning XML. Use of this function is strictly limited to the following scenarios.
|
||||
|
||||
@ -31,7 +31,7 @@ Here is a partial screenshot of the result:
|
||||
The auto-enrollment relies of the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically AAD registered.
|
||||
|
||||
> [!Note]
|
||||
> In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/en-us/library/mt221945.aspx). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.
|
||||
> In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.
|
||||
|
||||
When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user will get a prompt to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page.
|
||||
|
||||
|
||||
@ -117,7 +117,7 @@ The following diagram shows the EnterpriseAppVManagement configuration service p
|
||||
<p style="margin-left: 20px">Used to perform App-V synchronization.</p>
|
||||
|
||||
**AppVPublishing/Sync/PublishXML**
|
||||
<p style="margin-left: 20px">Used to execute the App-V synchronization using the Publishing protocol. For more information about the protocol see [[MS-VAPR]: Virtual Application Publishing and Reporting (App-V) Protocol](https://msdn.microsoft.com/en-us/library/mt739986.aspx).</p>
|
||||
<p style="margin-left: 20px">Used to execute the App-V synchronization using the Publishing protocol. For more information about the protocol see [[MS-VAPR]: Virtual Application Publishing and Reporting (App-V) Protocol](https://msdn.microsoft.com/library/mt739986.aspx).</p>
|
||||
<p style="margin-left: 20px">Supported operations are Get, Delete, and Execute.</p>
|
||||
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ The Firewall configuration service provider (CSP) allows the mobile device manag
|
||||
|
||||
Firewall rules in the FirewallRules section must be wrapped in an Atomic block in SyncML, either individually or collectively.
|
||||
|
||||
For detailed information on some of the fields below see [[MS-FASP]: Firewall and Advanced Security Protocol documentation](https://msdn.microsoft.com/en-us/library/mt620101.aspx).
|
||||
For detailed information on some of the fields below see [[MS-FASP]: Firewall and Advanced Security Protocol documentation](https://msdn.microsoft.com/library/mt620101.aspx).
|
||||
|
||||
The following diagram shows the Firewall configuration service provider in tree format.
|
||||
|
||||
@ -38,7 +38,7 @@ The following diagram shows the Firewall configuration service provider in tree
|
||||
<p style="margin-left: 20px">Value type in integer. Supported operation is Get.</p>
|
||||
|
||||
<a href="" id="currentprofiles"></a>**MdmStore/Global/CurrentProfiles**
|
||||
<p style="margin-left: 20px">Integer value that contains a bitmask of the current enforced profiles that are maintained by the server firewall host. See [FW_PROFILE_TYPE](https://msdn.microsoft.com/en-us/library/cc231559.aspx) for the bitmasks that are used to identify profile types. This value is available only in the dynamic store; therefore, it is not merged and has no merge law.</p>
|
||||
<p style="margin-left: 20px">Integer value that contains a bitmask of the current enforced profiles that are maintained by the server firewall host. See [FW_PROFILE_TYPE](https://msdn.microsoft.com/library/cc231559.aspx) for the bitmasks that are used to identify profile types. This value is available only in the dynamic store; therefore, it is not merged and has no merge law.</p>
|
||||
<p style="margin-left: 20px">Value type in integer. Supported operation is Get.</p>
|
||||
|
||||
<a href="" id="disablestatefulftp"></a>**MdmStore/Global/DisableStatefulFtp**
|
||||
@ -52,12 +52,12 @@ The following diagram shows the Firewall configuration service provider in tree
|
||||
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
|
||||
<a href="" id="presharedkeyencoding"></a>**MdmStore/Global/PresharedKeyEncoding**
|
||||
<p style="margin-left: 20px">Specifies the preshared key encoding that is used. The value is integer and MUST be a valid value from the [PRESHARED_KEY_ENCODING_VALUES enumeration](https://msdn.microsoft.com/en-us/library/cc231525.aspx). The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.</p>
|
||||
<p style="margin-left: 20px">Specifies the preshared key encoding that is used. The value is integer and MUST be a valid value from the [PRESHARED_KEY_ENCODING_VALUES enumeration](https://msdn.microsoft.com/library/cc231525.aspx). The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.</p>
|
||||
<p style="margin-left: 20px">Default value is 1.</p>
|
||||
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
|
||||
<a href="" id="ipsecexempt"></a>**MdmStore/Global/IPsecExempt**
|
||||
<p style="margin-left: 20px">This value configures IPsec exceptions. The value is integer and MUST be a combination of the valid flags that are defined in [IPSEC_EXEMPT_VALUES](https://msdn.microsoft.com/en-us/library/cc231523.aspx); therefore, the maximum value MUST always be IPSEC_EXEMPT_MAX-1 for servers supporting a schema version of 0x0201 and IPSEC_EXEMPT_MAX_V2_0-1 for servers supporting a schema version of 0x0200. If the maximum value is exceeded when the method RRPC_FWSetGlobalConfig (Opnum 4) is called, the method returns ERROR_INVALID_PARAMETER. This error code is returned if no other preceding error is discovered. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.</p>
|
||||
<p style="margin-left: 20px">This value configures IPsec exceptions. The value is integer and MUST be a combination of the valid flags that are defined in [IPSEC_EXEMPT_VALUES](https://msdn.microsoft.com/library/cc231523.aspx); therefore, the maximum value MUST always be IPSEC_EXEMPT_MAX-1 for servers supporting a schema version of 0x0201 and IPSEC_EXEMPT_MAX_V2_0-1 for servers supporting a schema version of 0x0200. If the maximum value is exceeded when the method RRPC_FWSetGlobalConfig (Opnum 4) is called, the method returns ERROR_INVALID_PARAMETER. This error code is returned if no other preceding error is discovered. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.</p>
|
||||
<p style="margin-left: 20px">Default value is 0.</p>
|
||||
<p style="margin-left: 20px">Value type is integer. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||
|
||||
@ -288,7 +288,7 @@ Sample syncxml to provision the firewall settings to evaluate
|
||||
<p style="margin-left: 20px">Boolean value. Supported operations are Get and Replace.</p>
|
||||
|
||||
<a href="" id="profiles"></a>**FirewallRules/_FirewallRuleName_/Profiles**
|
||||
<p style="margin-left: 20px">Specifies the profiles to which the rule belongs: Domain, Private, Public. . See [FW_PROFILE_TYPE](https://msdn.microsoft.com/en-us/library/cc231559.aspx) for the bitmasks that are used to identify profile types.</p>
|
||||
<p style="margin-left: 20px">Specifies the profiles to which the rule belongs: Domain, Private, Public. . See [FW_PROFILE_TYPE](https://msdn.microsoft.com/library/cc231559.aspx) for the bitmasks that are used to identify profile types.</p>
|
||||
<p style="margin-left: 20px">If not specified, the default is All.</p>
|
||||
<p style="margin-left: 20px">Value type is integer. Supported operations are Get and Replace.</p>
|
||||
|
||||
|
||||
@ -163,7 +163,7 @@ For mobile operator networks that require an entitlement check, the OEM must pro
|
||||
|
||||
The `EntitlementDll` parm of the HotSpot configuration service provider must be set to a string that is the path to this DLL.
|
||||
|
||||
The DLL must be code signed in a specific way, see [Sign binaries and packages](https://msdn.microsoft.com/en-us/library/windows/hardware/dn789217(v=vs.85).aspx).
|
||||
The DLL must be code signed in a specific way, see [Sign binaries and packages](https://msdn.microsoft.com/library/windows/hardware/dn789217(v=vs.85).aspx).
|
||||
|
||||
During an entitlement check the Internet Sharing service loads the specified DLL and then call the `IsEntitled` function. The function must connect to the server to perform any required validation, then return one of the following **ICS\_ENTITLEMENT\_RESULT** enumeration values.
|
||||
|
||||
|
||||
@ -48,7 +48,7 @@ MAM and MDM services in an organization could be provided by different vendors.
|
||||
|
||||
## MAM enrollment
|
||||
|
||||
MAM enrollment is based on the MAM extension of [[MS-MDE2] protocol](https://msdn.microsoft.com/en-us/library/mt221945.aspx). MAM enrollment supports Azure AD [federated authentication](federated-authentication-device-enrollment.md) as the only authentication method.
|
||||
MAM enrollment is based on the MAM extension of [[MS-MDE2] protocol](https://msdn.microsoft.com/library/mt221945.aspx). MAM enrollment supports Azure AD [federated authentication](federated-authentication-device-enrollment.md) as the only authentication method.
|
||||
|
||||
Below are protocol changes for MAM enrollment:
|
||||
- MDM discovery is not supported
|
||||
|
||||
@ -928,7 +928,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="even">
|
||||
<td style="vertical-align:top">The [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/en-us/library/mt221945.aspx)</td>
|
||||
<td style="vertical-align:top">The [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx)</td>
|
||||
<td style="vertical-align:top"><p>The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:</p>
|
||||
<ul>
|
||||
<li>UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page. </li>
|
||||
@ -2513,7 +2513,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
<td style="vertical-align:top"><p>Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.</p>
|
||||
</td></tr>
|
||||
<tr class="even">
|
||||
<td style="vertical-align:top">The [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/en-us/library/mt221945.aspx)</td>
|
||||
<td style="vertical-align:top">The [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx)</td>
|
||||
<td style="vertical-align:top"><p>The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:</p>
|
||||
<ul>
|
||||
<li>UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page. </li>
|
||||
|
||||
@ -14,7 +14,7 @@ ms.date: 03/12/2018
|
||||
|
||||
<hr/>
|
||||
|
||||
User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as SIDs or strings. Here is a list for reference, [Well-Known SID Structures](https://msdn.microsoft.com/en-us/library/cc980032.aspx). Even though strings are supported for well-known accounts and groups, it is better to use SIDs because strings are localized for different languages. Some user rights allow things, like AccessFromNetwork, while others disallow things, like DenyAccessFromNetwork.
|
||||
User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as SIDs or strings. Here is a list for reference, [Well-Known SID Structures](https://msdn.microsoft.com/library/cc980032.aspx). Even though strings are supported for well-known accounts and groups, it is better to use SIDs because strings are localized for different languages. Some user rights allow things, like AccessFromNetwork, while others disallow things, like DenyAccessFromNetwork.
|
||||
|
||||
Here is an example syncml for setting the user right BackupFilesAndDirectories for Administrators and Authenticated Users groups.
|
||||
|
||||
|
||||
@ -98,7 +98,7 @@ This node will return the following status. All OMA DM errors are listed [here](
|
||||
<a href="" id="lockandrecoverpin"></a>**LockAndRecoverPIN**
|
||||
Added in Windows 10, version 1703. This setting performs a similar function to the LockAndResetPIN node. With LockAndResetPIN any Windows Hello keys associated with the PIN gets deleted, but with LockAndRecoverPIN those keys are saved. After the Exec operation is called successfully on this setting, the new PIN can be retrieved from the NewPINValue setting. The previous PIN will no longer work.
|
||||
|
||||
Executing this node requires a ticket from the Microsoft credential reset service. Additionally, the execution of this setting is only supported when the [EnablePinRecovery](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/passportforwork-csp#tenantid-policies-enablepinrecovery) policy is set on the client.
|
||||
Executing this node requires a ticket from the Microsoft credential reset service. Additionally, the execution of this setting is only supported when the [EnablePinRecovery](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/passportforwork-csp#tenantid-policies-enablepinrecovery) policy is set on the client.
|
||||
|
||||
|
||||
<a href="" id="newpinvalue"></a>**NewPINValue**
|
||||
|
||||
@ -72,7 +72,7 @@ Note that most Group Policies are a simple Boolean type. For a Boolean Group Pol
|
||||
> [!IMPORTANT]
|
||||
> Any data entry field that is displayed in the Group Policy page of the Group Policy Editor must be supplied in the encoded XML of the SyncML payload. The SyncML data payload is equivalent to the user-supplied Group Policy data through GPEdit.msc.
|
||||
|
||||
For more information about the Group Policy description format, see [Administrative Template File (ADMX) format](https://msdn.microsoft.com/en-us/library/aa373476(v=vs.85).aspx). Elements can be Text, MultiText, Boolean, Enum, Decimal, or List (for more information, see [policy elements](https://msdn.microsoft.com/en-us/library/dn606004(v=vs.85).aspx)).
|
||||
For more information about the Group Policy description format, see [Administrative Template File (ADMX) format](https://msdn.microsoft.com/library/aa373476(v=vs.85).aspx). Elements can be Text, MultiText, Boolean, Enum, Decimal, or List (for more information, see [policy elements](https://msdn.microsoft.com/library/dn606004(v=vs.85).aspx)).
|
||||
|
||||
For example, if you search for the string, "Publishing_Server2_Name_Prompt" in both the *Enabling a policy* example and its corresponding ADMX policy definition in the appv.admx file, you will find the following occurrences:
|
||||
|
||||
|
||||
@ -102,7 +102,7 @@ The XML below is for Windows 10, version 1809.
|
||||
</AccessType>
|
||||
<Description>
|
||||
XML describing the network configuration and follows Windows WLAN_profile schema.
|
||||
Link to schema: http://msdn.microsoft.com/en-us/library/windows/desktop/ms707341(v=vs.85).aspx
|
||||
Link to schema: http://msdn.microsoft.com/library/windows/desktop/ms707341(v=vs.85).aspx
|
||||
</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
|
||||
@ -24,7 +24,7 @@ The following diagram shows the WiredNetwork configuration service provider in t
|
||||
Root node.
|
||||
|
||||
<a href="" id="lanxml"></a>**LanXML**
|
||||
Optional. XML describing the wired network configuration and follows the LAN_profile schemas https://msdn.microsoft.com/en-us/library/windows/desktop/aa816366(v=vs.85).aspx.
|
||||
Optional. XML describing the wired network configuration and follows the LAN_profile schemas https://msdn.microsoft.com/library/windows/desktop/aa816366(v=vs.85).aspx.
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is string.
|
||||
|
||||
|
||||
@ -54,7 +54,7 @@ The XML below is the current version for this CSP.
|
||||
<Delete />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>XML describing the wired network configuration and follows the LAN_profile schemas https://msdn.microsoft.com/en-us/library/windows/desktop/aa816366(v=vs.85).aspx</Description>
|
||||
<Description>XML describing the wired network configuration and follows the LAN_profile schemas https://msdn.microsoft.com/library/windows/desktop/aa816366(v=vs.85).aspx</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
@ -123,7 +123,7 @@ The XML below is the current version for this CSP.
|
||||
<Delete />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>XML describing the wired network configuration and follows the LAN_profile schemas https://msdn.microsoft.com/en-us/library/windows/desktop/aa816366(v=vs.85).aspx</Description>
|
||||
<Description>XML describing the wired network configuration and follows the LAN_profile schemas https://msdn.microsoft.com/library/windows/desktop/aa816366(v=vs.85).aspx</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
|
||||
@ -265,7 +265,7 @@ For links to these classes, see [**MDM Bridge WMI Provider**](https://msdn.micro
|
||||
[**Win32\_PageFileSetting**](https://msdn.microsoft.com/library/windows/hardware/aa394245) |
|
||||
[**Win32\_ParallelPort**](https://msdn.microsoft.com/library/windows/hardware/aa394247) |
|
||||
[**Win32\_PCMCIAController**](https://msdn.microsoft.com/library/windows/hardware/aa394251) |
|
||||
[**Win32\_PhysicalMedia**](https://msdn.microsoft.com/en-us/library/windows/hardware/aa394346) |
|
||||
[**Win32\_PhysicalMedia**](https://msdn.microsoft.com/library/windows/hardware/aa394346) |
|
||||
[**Win32\_PhysicalMemory**](https://msdn.microsoft.com/library/windows/hardware/aa394347) | 
|
||||
[**Win32\_PnPDevice**](https://msdn.microsoft.com/library/windows/hardware/aa394352) |
|
||||
[**Win32\_PnPEntity**](https://msdn.microsoft.com/library/windows/hardware/aa394353) |
|
||||
|
||||
@ -227,8 +227,8 @@ Enforcing what accounts employees can use on a corporate device is important for
|
||||
|
||||
Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies.
|
||||
|
||||
- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [ActiveSync CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920017(v=vs.85).aspx).
|
||||
- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile.
|
||||
- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [ActiveSync CSP](https://msdn.microsoft.com/library/windows/hardware/dn920017(v=vs.85).aspx).
|
||||
- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile.
|
||||
|
||||
### <a href="" id="device-lock-restrictions"></a>Device Lock restrictions
|
||||
|
||||
@ -257,7 +257,7 @@ Most of the device lock restriction policies have been available via ActiveSync
|
||||
Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario.
|
||||
Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an AAD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment.
|
||||
|
||||
You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information.
|
||||
You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information.
|
||||
|
||||
### <a href="" id="prevent-of-settings"></a>Prevent changing of settings
|
||||
|
||||
@ -303,7 +303,7 @@ Certificates help improve security by providing account authentication, Wi Fi au
|
||||
To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes.
|
||||
Using SCEP and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device (as long as the MDM system supports the Simple Certificate Enrollment Protocol (SCEP) or Personal Information Exchange (PFX)). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired.
|
||||
In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings.
|
||||
Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile).
|
||||
Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile).
|
||||
Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently.
|
||||
|
||||
>**Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you:
|
||||
@ -349,7 +349,7 @@ In addition, you can set a few device wide Wi-Fi settings.
|
||||
- **Allow Internet Sharing** Allow or disallow Internet sharing
|
||||
- **WLAN Scan Mode** How actively the device scans for Wi-Fi networks
|
||||
|
||||
Get more detailed information about Wi-Fi connection profile settings in the [Wi-Fi CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx).
|
||||
Get more detailed information about Wi-Fi connection profile settings in the [Wi-Fi CSP](https://msdn.microsoft.com/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx).
|
||||
|
||||
### <a href="" id="apn-profiles"></a>APN profiles
|
||||
|
||||
@ -381,7 +381,7 @@ You can define and deploy APN profiles in MDM systems that configure cellular da
|
||||
- **Allow user control** Allows users to connect with other APNs than the enterprise APN
|
||||
- **Hide view** Whether the cellular UX will allow the user to view enterprise APNs
|
||||
|
||||
Get more detailed information about APN settings in the [APN CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn958617(v=vs.85).aspx).
|
||||
Get more detailed information about APN settings in the [APN CSP](https://msdn.microsoft.com/library/windows/hardware/dn958617(v=vs.85).aspx).
|
||||
|
||||
### <a href="" id="proxy"></a>Proxy
|
||||
|
||||
@ -399,7 +399,7 @@ The below lists the Windows 10 Mobile settings for managing APN proxy settings f
|
||||
- **Proxy connection type** The proxy connection type, supporting: Null proxy, HTTP, WAP, SOCKS4
|
||||
- **Port** The port number of the proxy connection
|
||||
|
||||
For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914762(v=vs.85).aspx).
|
||||
For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.microsoft.com/library/windows/hardware/dn914762(v=vs.85).aspx).
|
||||
|
||||
### <a href="" id="vpn"></a>VPN
|
||||
|
||||
@ -449,7 +449,7 @@ In addition, you can specify per VPN Profile:
|
||||
- No other VPN profiles can be connected or modified.
|
||||
- **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require.
|
||||
|
||||
For more details about VPN profiles, see the [VPNv2 CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914776(v=vs.85).aspx)
|
||||
For more details about VPN profiles, see the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776(v=vs.85).aspx)
|
||||
|
||||
Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges.
|
||||
- **Allow VPN** Whether users can change VPN settings
|
||||
@ -495,7 +495,7 @@ For compatibility with existing apps, Windows Phone 8.1 apps still run on Window
|
||||
|
||||
Microsoft also made it easier for organizations to license and purchase UWP apps via Microsoft Store for Business and deploy them to employee devices using the Microsoft Store, or an MDM system, that can be integrated with the Microsoft Store for Business. Putting apps into the hands of mobile workers is critical, but you also need an efficient way to ensure those apps comply with corporate policies for data security.
|
||||
|
||||
To learn more about Universal Windows apps, see the [Guide to Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/en-us/library/windows/apps/dn894631.aspx) for additional information, or take this [Quick Start Challenge: Universal Windows Apps in Visual Studio](https://mva.microsoft.com/en-US/training-courses/quick-start-challenge-universal-windows-apps-in-visual-studio-14477?l=Be2FMfgmB_505192797). Also, see [Porting apps to Windows 10](https://msdn.microsoft.com/en-us/windows/uwp/porting/index).
|
||||
To learn more about Universal Windows apps, see the [Guide to Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/library/windows/apps/dn894631.aspx) for additional information, or take this [Quick Start Challenge: Universal Windows Apps in Visual Studio](https://mva.microsoft.com/en-US/training-courses/quick-start-challenge-universal-windows-apps-in-visual-studio-14477?l=Be2FMfgmB_505192797). Also, see [Porting apps to Windows 10](https://msdn.microsoft.com/windows/uwp/porting/index).
|
||||
|
||||
### <a href="" id="windows-store-for-business"></a>Microsoft Store for Business: Sourcing the right app
|
||||
|
||||
@ -532,7 +532,7 @@ IT administrators can control which apps are allowed to be installed on Windows
|
||||
|
||||
Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store.
|
||||
|
||||
For more details, see [AppLocker CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920019(v=vs.85).aspx).
|
||||
For more details, see [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx).
|
||||
|
||||
In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM.
|
||||
|
||||
@ -546,9 +546,9 @@ In addition to controlling which apps are allowed, IT professionals can also imp
|
||||
- **Require Private Store Only** Whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available.
|
||||
- **Restrict App Data to System Volume** Whether app data is allowed only on the system drive or can be stored on an SD card.
|
||||
- **Restrict App to System Volume** Whether app installation is allowed only to the system drive or can be installed on an SD card.
|
||||
- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](https://msdn.microsoft.com/en-us/library/windows/hardware/mt171093(v=vs.85).aspx) for more information).
|
||||
- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](https://msdn.microsoft.com/library/windows/hardware/mt171093(v=vs.85).aspx) for more information).
|
||||
|
||||
Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps)
|
||||
Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps)
|
||||
|
||||
### <a href="" id="data-leak-prevention"></a>Data leak prevention
|
||||
|
||||
@ -592,7 +592,7 @@ The following table lists the settings that can be configured for Windows Inform
|
||||
|
||||
>**Note:** * Are mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings - specifically Enterprise IP Range and Enterprise Network Domain Names – must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key (so that others in the company can access it.
|
||||
|
||||
For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip).
|
||||
For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip).
|
||||
|
||||
### <a href="" id="managing-user-activities"></a>Managing user activities
|
||||
|
||||
@ -802,7 +802,7 @@ To learn more about diagnostic, see [Configure Windows diagnostic data in your o
|
||||
|
||||
To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning package to inject the Windows 10 Enterprise license on a Windows 10 Mobile device. Licenses can be obtained from the Volume Licensing portal. For testing purposes, you can obtain a licensing file from the MSDN download center. A valid MSDN subscription is required.
|
||||
|
||||
Details on updating a device to Enterprise edition with [WindowsLicensing CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904983(v=vs.85).aspx)
|
||||
Details on updating a device to Enterprise edition with [WindowsLicensing CSP](https://msdn.microsoft.com/library/windows/hardware/dn904983(v=vs.85).aspx)
|
||||
|
||||
>**Recommendation:** Microsoft recommends using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices.
|
||||
|
||||
@ -881,7 +881,7 @@ Pause Feature Updates for up to 35 days</td>
|
||||
|
||||
*Applies to: Corporate devices with Enterprise edition*
|
||||
|
||||
Set update client experience with [Allowautomaticupdate](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_AllowAutoUpdate) policy for your employees. This allows the IT Pro to influence the way the update client on the devices behaves when scanning, downloading, and installing updates.
|
||||
Set update client experience with [Allowautomaticupdate](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_AllowAutoUpdate) policy for your employees. This allows the IT Pro to influence the way the update client on the devices behaves when scanning, downloading, and installing updates.
|
||||
|
||||
This can include:
|
||||
- Notifying users prior to downloading updates.
|
||||
@ -891,7 +891,7 @@ This can include:
|
||||
- Automatically downloading and restarting devices without user interaction.
|
||||
- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device will not receive any updates.
|
||||
|
||||
In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.).
|
||||
In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.).
|
||||
|
||||
**Managing the source of updates with MDM**
|
||||
|
||||
|
||||
Reference in New Issue
Block a user